PSPF maturity reporting is the annual moment where a Commonwealth entity’s security posture is laid bare for its accountable authority and its portfolio. Done well, it is a genuine management tool that drives investment and closes real gaps. Done poorly, it becomes a box-ticking exercise that overstates maturity, exposes the accountable authority and leaves the entity quietly carrying risk it does not understand.
This guide walks through how non-corporate Commonwealth entities should approach the Protective Security Policy Framework (PSPF) maturity assessment, what evidence stands up to scrutiny, and the mistakes that consistently undermine a credible report.
What the PSPF maturity model actually asks
The PSPF sets out the Australian Government’s protective security requirements across governance, information security, personnel security and physical security. Non-corporate Commonwealth entities are required to apply it, and the accountable authority must report annually on the entity’s security maturity.
The assessment uses a four-level maturity scale rather than a simple pass or fail:
- Ad hoc – the requirement is partially implemented, inconsistent or undocumented.
- Developing – implementation has started but is incomplete or not yet operating reliably across the entity.
- Managing – the requirement is fully implemented and operating as intended.
- Embedded – the requirement is fully implemented, monitored and continuously improved as part of business as usual.
The shift to a maturity scale matters. It asks you to be honest about how consistently a control operates, not just whether a policy exists. A documented vulnerability management standard that nobody follows is not “Managing” – it is “Ad hoc” with good paperwork.
Governance, information, personnel and physical – the full scope
It is easy to let cyber dominate the assessment, but the PSPF is broader than the Essential Eight. A complete maturity report covers all four security domains, and weaknesses outside cyber are just as capable of harming the entity.
- Security governance – whether the entity has clear accountabilities, a security plan, risk management processes and a culture that supports security.
- Information security – how information is valued, classified, handled, stored and shared, including the management of sensitive and security-classified information.
- Personnel security – vetting, ongoing suitability, the eligibility and clearance of people accessing information, and managing insiders and separations.
- Physical security – the protection of people, facilities and the physical environments where information and assets are held.
Assessing each domain honestly often surfaces uncomfortable findings – for example, that security classification is applied inconsistently, or that access is not revoked promptly when staff leave. These are exactly the gaps a maturity report exists to expose, so resist the temptation to gloss over the non-cyber domains.
Map your evidence before you score anything
The single biggest determinant of a defensible PSPF report is evidence. For each core requirement, you should be able to point to artefacts that show the control is real, current and operating across the entity, not just in one well-run team.
Useful evidence includes:
- Policies and standards with version control and a current review date – stale documents undercut a “Managing” or “Embedded” rating.
- Operational records such as patch reports, access review logs, security incident records and training completion data.
- Technical outputs like vulnerability scan results, configuration baselines and Essential Eight assessment data.
- Assurance activities including internal audit findings, penetration test reports and independent assessments.
Gather evidence first, then score. Reverse that order and you will rate to a target rather than to reality – the most common way reports drift into fiction.
A practical discipline is to maintain an evidence register that maps each PSPF requirement to its supporting artefacts, the owner of each artefact, and the date it was last refreshed. This turns the annual assessment from a once-a-year archaeology project into a continuous activity, and it means that when the accountable authority or an auditor asks “what does this rating rest on?”, you have an immediate, traceable answer rather than a scramble through shared drives.
The Essential Eight is your mandatory cyber baseline
Within the PSPF, the Essential Eight is the mandatory technical baseline for cyber security. You must report your Essential Eight maturity level for each of the eight mitigation strategies – application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups.
Essential Eight maturity runs from Maturity Level Zero through to Maturity Level Three, and it is assessed independently of the four-level PSPF scale. A critical point that trips entities up: the Essential Eight maturity model is assessed as an aligned set. Your overall Essential Eight maturity is effectively held back by the weakest of the eight strategies, because the model is designed to be implemented as a package. Claiming Maturity Level Two while one strategy sits at Level One is a misstatement.
For a deeper walk-through of the strategies and how the levels build on each other, our Essential Eight explained guide breaks down each control and what implementation actually looks like.
Common mistakes that wreck a report
After many assessments, the same failure patterns recur. Watch for these:
- Rating policy, not practice. A signed policy is necessary but not sufficient. Maturity is about consistent operation across the entity.
- Optimism bias. Self-assessment tends to round up. Build in independent challenge – have someone outside the security team test the evidence behind the highest ratings.
- Scope gaps. Shadow IT, cloud services procured by business units and legacy systems are frequently excluded, producing a flattering but inaccurate picture.
- Misaligned Essential Eight scoring. Reporting an overall maturity level higher than the weakest individual strategy.
- Year-on-year inconsistency. Changing how a requirement is interpreted between years makes trend analysis meaningless and invites questions.
- Late evidence collection. Scrambling for artefacts after 30 June guarantees gaps and rushed judgements.
Be consistent in how you interpret a rating
Maturity reporting is most valuable as a trend. The accountable authority and the portfolio want to know whether the entity is improving, holding steady or slipping. That signal is only meaningful if the entity interprets the maturity levels consistently from one year to the next.
A common, subtle failure is “definition drift” – where a new security lead reads “Managing” more generously than their predecessor, and a requirement appears to jump a level without any real change on the ground. Guard against this by documenting, for each requirement, what specific evidence justifies each maturity level for your entity. That rubric becomes the institutional memory that keeps assessments comparable across years and across the people doing the assessing.
It also pays to keep the rationale for each rating, not just the rating itself. A short note explaining why a requirement was scored “Developing” rather than “Managing” – and what would need to change to move it up – is invaluable when you revisit it twelve months later or when leadership turns over.
Make the accountable authority’s sign-off meaningful
The accountable authority owns the report. They cannot delegate that accountability, even though the CISO and security team do the work. That has a practical consequence: the assessment must be framed in terms a senior executive can genuinely interrogate and stand behind.
Give the accountable authority a clear summary of where the entity sits, where it has slipped or improved since last year, the residual risks behind any “Ad hoc” or “Developing” ratings, and the remediation plan and investment those gaps require. The attestation should be a considered judgement supported by evidence – not a signature on a document the authority has not been equipped to challenge.
Turn reporting into a remediation cycle
The point of maturity reporting is not the report. It is the conversation it forces about risk and investment. The strongest entities treat the annual assessment as the close of a continuous cycle: assess, prioritise the gaps that carry the most risk, fund and deliver remediation, then reassess.
Tie each “Ad hoc” or “Developing” rating to a named owner, a target maturity level and a date. Track it through the year rather than rediscovering it next June. That discipline is what moves controls toward “Embedded” and steadily lifts the entity’s posture.
Prioritise by risk, not by ease. It is tempting to clear the simple, low-impact gaps to show movement, while the genuinely risky shortfalls – unrestricted privileged access, untested backups, inconsistent handling of PROTECTED information – persist year after year because they are harder to fix. A credible remediation plan front-loads the gaps that carry the most risk to the entity’s people, information and operations, even when they are the uncomfortable ones to confront.
Finally, connect the plan to investment. Maturity rarely lifts without resourcing, and the report is the single best opportunity each year to make the case to leadership. Frame each remediation item in terms of the risk it retires and the cost to close it, so the accountable authority can make an informed decision about what to fund and what residual risk to accept.
Where to get help
Many entities have the technical capability but lack the independent, senior perspective to challenge their own self-assessment and prepare the accountable authority. A Virtual CISO arrangement can provide that challenge function, run the evidence-led assessment and translate findings into a board-ready remediation plan. CISO Advisory works with federal, state and local government entities on exactly this – see our government cybersecurity services or call 07 2112 8502 for a confidential discussion before your next reporting cycle.
Frequently asked questions
Who has to report against the PSPF?
Non-corporate Commonwealth entities subject to the Public Governance, Performance and Accountability Act 2013 must apply the PSPF and report annually. Corporate Commonwealth entities and Commonwealth companies are encouraged to apply it as good practice, and some are directed to by their portfolio minister or enabling legislation.
What are the PSPF maturity levels?
The current PSPF assessment model uses four maturity ratings: Ad hoc, Developing, Managing and Embedded. Entities self-assess each core requirement against these levels, supported by evidence, rather than simply marking a requirement compliant or non-compliant as under the older model.
Who signs off the PSPF report?
The accountable authority of the entity is responsible for the annual PSPF assessment and attestation. They cannot delegate that accountability, although the CISO, security adviser and governance team prepare the underlying assessment, evidence and analysis that informs the authority's judgement.
How does the Essential Eight fit into PSPF reporting?
The Essential Eight is the mandatory technical baseline within the PSPF. Entities report their Essential Eight maturity level (Maturity Level One to Three) for each of the eight mitigation strategies as part of their broader PSPF assessment of cyber security and technology security requirements.
When is the PSPF report due?
Entities assess against the financial year and report to their portfolio department and relevant bodies after year-end, typically in the months following 30 June. Confirm the exact deadline and reporting channels each year, as the Department of Home Affairs and the Attorney-General's Department periodically update the process.
Need this handled for your organisation?
Confidential and no obligation. We respond the same business day — on-site same day / next business day, or remote, Australia-wide. Prefer to talk now? Call us 24/7 on 07 2112 8502.